In a two-tier hierarchy CA design, what is a common security best practice?
The intermediate or policy CA server is offline.
The issuing CA servers are placed in different geographical locations.
The root CA server is offline.
Only FIPS-compliant hardware security modules are used.